{"id":"CVE-2026-17541","state":"PUBLISHED","title":"Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure","description":"The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.","publishedAt":"2026-08-10T06:00:10.691Z","updatedAt":"2026-08-10T19:22:33.386Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown File Manager"],"affected":[{"vendor":"Unknown","product":"File Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.9.1","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/17xxx/CVE-2026-17541.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-17541","state":"PUBLISHED","datePublished":"2026-08-10T06:00:10.691Z","dateUpdated":"2026-08-10T19:22:33.386Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-07-27T10:00:18.731Z"},"containers":{"cna":{"title":"Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure","descriptions":[{"lang":"en","value":"The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them."}],"affected":[{"vendor":"Unknown","product":"File Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.9.1","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-08-10T06:00:10.691Z"},"credits":[{"lang":"en","value":"Farid Narimanov","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T19:21:38.653821Z","id":"CVE-2026-17541","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T19:22:33.386Z"}}]}}}